Vulnerabilities / Wicked Folders / WPSEC-2026-0406
Wicked Folders <= 4.1.3 - Authenticated (Contributor+) Missing Authorization to Folder Assignment of Arbitrary Posts via REST API
Medium 4.3
CWE-862Fixed in 4.2.0
- ID
- WPSEC-2026-0406
- Plugin
- Wicked Folders – Folder Organizer for Pages, Posts, and Custom Post Types (wicked-folders)
- Affected
- all versions before 4.2.0
- Remediation
- Update to 4.2.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-862
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-22
- Attack surface
- Wicked Folders on WPSec AttackSurface
- Fix released
- Published
Description
The Wicked Folders plugin for WordPress is vulnerable to unauthorized modification of data in all versions up to, and including, 4.1.3 due to missing per-item capability checks in the REST API folder assign and unassign endpoints (and, before version 3.0.0, the move_object AJAX action), which only verified the generic edit_posts capability. This makes it possible for authenticated attackers, with Contributor-level access and above, to assign posts they cannot edit to folders or remove them from folders, and to add other existing terms, such as categories or tags, to those posts.
References
- https://wpsec.com/vuln/WPSEC-2026-0406/
- https://plugins.svn.wordpress.org/wicked-folders/tags/4.2.0/
- https://wordpress.org/plugins/wicked-folders/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS